fix: portal/twin password counting

[phutur1st]

Summary

Fixes Evil Portal and Evil Twin credential counting so only received form data lines are treated as captured passwords.

Previously, client status lines such as client connects and client count updates were saved into the portal/twin capture logs. Because loot totals counted every line in those files, non-credential events inflated the password/capture totals.

Changes

• Add a shared portal/twin form-line detector.
• Save only received form data lines to:
  • portal_passwords.log
  • evil_twin_capture.log
• Preserve recognized portal/twin client and form activity in separate activity logs so credential logs can stay form-only without losing useful session context:
  • portal_events.log
  • evil_twin_events.log
• Keep client connect/count messages visible in the live terminal without counting them as credentials.
• Filter historical portal/twin capture logs with the same rule when loading the password viewer.
• Recount portal/twin loot totals using only form-data lines.
• Bump the loot DB version so existing cached totals rebuild once with corrected counts.

Notes

The loot DB rebuild uses the existing rebuild path. As a result, version 1 databases will be regenerated as version 2, correcting inflated historical portal/twin counts.

Fixes #9

[phutur1st]

Testing

Tested locally on historical and new captures

[phutur1st]

Question for @LOCOSP - The core bug (credential counts inflated by client connect/count messages) required roughly ~20 net lines — the is_portal_form_line filter, the count fix in _rebuild_db, and the DB version bump.

The remaining ~30 lines come from the new save_portal_activity / save_evil_twin_activity methods and the accompanying portal_events.log / evil_twin_events.log files. The intent was to preserve client connect/count events in a separate debug log rather than discard them silently.

Is that debug log worth keeping, or would you prefer a leaner patch that simply discards non-form events and skips the new log files entirely? Happy to revise if simpler is better here.

Zdrowie!